fix(gds): a plan that cannot carry a ruleset is not drift - #43
Merged
Merged
Conversation
The contract read the live ruleset and treated every failure the same way, so a private repository on a free plan -- where the API answers 403 "Upgrade to GitHub Pro or make this repository public" -- would have failed on every run with a message about an unreadable ruleset. Three different facts wearing one error: drift, a token without permission, and a plan that cannot buy branch protection at all. Measured across the estate on 2026-08-24: 68 repositories can carry a ruleset, 9 cannot, all of them private on free organizations. So this was not an edge case, it was a tenth of the estate. Where rulesets are unavailable the check inverts rather than disappearing. No branch can require anything there, so the only claim the anchor can get wrong is claiming assurance that cannot exist -- and that still fails, with the exact lines to remove. Found by a consumer refusing to adopt it and saying why, which is the review this needed and did not get from me.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Correction to #42, found by a consumer who declined to adopt it and gave the reason.
The defect
The contract read the caller's live ruleset and treated every API failure identically. On a private repository in a free organization the API answers:
So the job would have failed on every run with "cannot read the ruleset" — one message covering three unrelated facts: real drift, a token without permission, and a plan where branch protection cannot be bought at all.
Not an edge case
Measured across the estate on 2026-08-24:
All nine are private repositories in free organizations. A tenth of the estate would have got a permanent red check that said the wrong thing.
What it does now
Where rulesets are unavailable the check inverts instead of disappearing. No branch there can require anything, so the one claim an anchor can still get wrong is claiming assurance that cannot exist:
All four verified against live repositories before this commit.
Worth recording
The consumer's second reason was policy, not mechanics: the owner asked today for guards to come off, not go on, and a new mandatory check on a repository where it cannot work is the worst version of that. They were right to refuse, and the refusal is what exposed the defect.